What the FCA's October 2026 AI findings mean for customer outcomes.
On 19 October 2026 the FCA published AI in financial services: good practice and areas for improvement. It updated the page on 20 October 2026. The publication draws on firm engagement, supervisory work and the FCA's AI Lab, including AI Live Testing and the Supercharged Sandbox. It says the examples do not create new requirements. They show what the FCA has seen, and where that helps or harms a customer.
Firms remain responsible for the outcome
The FCA says that where firms deploy AI-supported tools, they remain responsible for consumer outcomes. That includes outcomes delivered through products, services, communications and support. It asks firms to consider the Consumer Duty guidance, FG22/5, and the guidance on the fair treatment of vulnerable customers, FG21/1.
The page does not give an example for every part of the Duty. It says that gap, including on fair value, does not remove the need for firms to consider those parts of the regulation. When AI is deployed safely, the FCA says it saw benefits for consumers through efficiency, lower cost, and services that are more accessible and more tailored.
What the FCA describes as good practice
Under the Consumer Duty section, the FCA says firms that use AI safely and responsibly:
- Define the consumer need and target market before designing and deploying AI-supported products and services.
- Test consumer outcomes across different consumer characteristics and scenarios.
- Use proportionate controls to manage AI bias and accuracy, so that decisions can be explained.
- Tell consumers how they have used AI, and its limits, and test understanding where that is appropriate.
- Monitor live outcomes so they can spot issues and deal with them.
On products and services, the FCA describes firms deciding where AI should support or automate a task, where the task should stay with a member of staff, and where the tool should stop and pass the person to someone else. It also describes testing for unfair differences across groups, including vulnerability and digital or financial capability.
One example in the publication is a firm that defined the outcomes it wanted, and the measures of success, before a narrow pilot. The FCA presents that as a way to check that AI meets a defined need, rather than becoming the objective itself.
On consumer understanding, good practice includes saying what an AI-enabled tool can and cannot do, and when the person should look elsewhere for help. The FCA describes firms keeping records of prompts, outputs, model versions, filters and escalation decisions, so a complaint or a challenge can be investigated. One credit example used plain explainers at the point of use, and sent people to free debt advice or to a member of staff when the tool could not act.
On support for customers in vulnerable circumstances, the FCA describes firms using tools to spot possible indicators, such as words in a reply, spending patterns, or signs that a digital journey is not working. It also describes giving people a choice of AI-enabled or non-AI support for straightforward tasks, and letting them change channel without repeating the same information. In one chatbot example, the firm worked with frontline staff on which vulnerability indicators to look for, kept a live list of proxy terms, and had a plan for supporting a flagged customer through the tool or through a human adviser. It then monitored whether outcomes improved.
Where the FCA says practice was poor
The same publication sets out the gaps it saw. I am staying with what that page states.
- Building the tool without a consumer problem, a target market, or a view of foreseeable harms.
- Guardrails that deal with one risk and create another. In one case, guardrails reduced model drift and unexpected responses, and the tool then gave overly generic outcomes that steered some consumers towards inappropriate options.
- Excluding consumers in vulnerable circumstances from AI journeys by default. The FCA says that may be right in some cases, and that it can exclude people unfairly if there is no other way for them to get support.
- Assuming outputs are clear without testing them with different groups, including people with lower financial capability, accessibility needs, or characteristics of vulnerability.
- Giving technical information about a model without saying what it means for that person, why an outcome happened, or what they can do next.
- Overstating accuracy, reliability or the role of the system, or leaving it unclear whether AI or a person performed a function.
- Long gaps between reviews of live outcomes, or escalation triggers that are too vague. The FCA notes there is no set timescale, and that more frequent review can show harm sooner.
- Assuming a large language model can reliably identify vulnerability, in particular vulnerability that is temporary, without enough testing or safeguards.
- Automated journeys that are hard to leave: unclear replies, a failure to deal with the issue, or no route to another channel.
What I would change in the journey
If a tool is already in a customer journey, the useful starting point is the FCA's examples, not a new policy document. Name the customer need the tool is there to meet. If you cannot name it, the poor-practice examples are about tools built without a problem.
Then check the route for a customer in vulnerable circumstances. The FCA's concern is a default exclusion with nowhere else to go, and a model that is trusted to spot vulnerability before anyone has tested that. A workable journey keeps another channel, and a person who can take over, without making the customer start again.
Keep the record the FCA describes firms using when a customer challenges an outcome: the prompt, the output, the model version, and the point at which a person stepped in. That is an operating change. How I take this on with a firm is on the AI and customer service page. The Duty context is on the Consumer Duty page.
The EU AI Act, from the customer's side
The FCA page says some of these topics are also covered by laws that other regulators oversee, including data protection and equality law. It says firms should go to the relevant legislation and to guidance from those regulators. It does not itself set out the EU AI Act.
Regulation (EU) 2024/1689 is the EU Artificial Intelligence Act. Recital 58 says AI systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk, because they determine access to financial resources or to essential services such as housing, electricity and telecommunications. Annex III, point 5(b), lists AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with an exception for systems used to detect financial fraud. Point 5(c) lists AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance.
Article 50 is the transparency rule that meets the customer directly. Providers of AI systems intended to interact directly with natural persons must design and develop them so that the person is informed they are interacting with an AI system, unless this is obvious from the circumstances and the context of use. The European Commission's questions and answers on Article 50 say the article applies from 2 August 2026, and that people should be told from the start of the first interaction, in a way that is clear and accessible. The Commission also says a system that only runs in the background, with no direct contact with a person, falls outside that particular obligation.
For a firm with customers in the EU, the overlap with the FCA examples is practical. If a person is talking to the tool, they should be able to tell that it is AI, and they should be able to see what it can and cannot do. The FCA already describes that as good practice under the Duty. The Act adds a legal transparency duty for direct interaction, and a high-risk classification for creditworthiness and for pricing in life and health insurance. Your counsel decides whether a given tool is in scope. The change I make is in the journey: the customer can tell what they are dealing with, and a poor outcome can be seen and challenged.
Common questions
Did the FCA create new AI rules on 19 October 2026?
No. The FCA's good and poor practice publication says the examples do not create new requirements, prescribe one model, or replace a firm's own judgement about what is proportionate. Firms remain responsible for consumer outcomes under the existing framework, including the Consumer Duty.
What did the FCA say about customers in vulnerable circumstances?
The FCA points firms to FG21/1 as well as the Consumer Duty guidance. Good practice includes testing outcomes across characteristics such as vulnerability and digital or financial capability. Poor practice includes excluding those customers from an AI journey by default when there is no other way for them to get support, and assuming a model can spot vulnerability without enough testing.
Does the EU AI Act say a customer must be told they are talking to AI?
Article 50 of Regulation (EU) 2024/1689 says providers of AI systems intended to interact directly with natural persons must design them so the person is informed they are interacting with an AI system, unless that is obvious from the circumstances. The European Commission says Article 50 applies from 2 August 2026. A system with no direct contact with a person is outside that particular duty. This is not a legal opinion on any one tool.
Sources
- FCA, AI in financial services: good practice and areas for improvement, published 19 October 2026, updated 20 October 2026.
- Regulation (EU) 2024/1689, the Artificial Intelligence Act, on EUR-Lex. Recital 58 and Annex III, point 5.
- European Commission, Transparency obligations under Article 50 of the AI Act.